MK Smart strengthens its eID portfolio with Common Criteria certification in collaboration with Applus+ Laboratories 

Preparing a robust ICAO DOC 9303 application for evaluation  

In the early stages of the project, MKSmart received pre-evaluation assessment, including high-level technical feedback and pre-code reviews, to enable the implementation aligned with Common Criteria expectations prior to entering the formal evaluation phase.  

In line with Common Criteria methodology, the evaluation focused on the ICAO application running in its operational environment — MKSmart’s LOTUS secure OS— ensuring a realistic and comprehensive security assessment. Originally developed for payment applications, the LOTUS OS platform has been further enhanced to enable digital identity use cases, demonstrating its flexibility across a wide range of high-security applications.  

This milestone enables MKSmart to participate in global high-assurance digital identity programs, where EAL4+ and EAL5+ certification is widely recognized as a prerequisite.  

Two high-assurance Common Criteria certifications  

To validate the security of the ICAO application, MKSmart completed two Common Criteria evaluations, with both certificates issued in February 2026 by the Spanish National Cryptologic Centre (CCN). All evaluation activities were conducted by Applus+ Laboratories.  

EAL4+ for Basic Access Control (BAC)  

The configuration implementing Basic Access Control (BAC) —the mechanism that protects personal data stored in the ePassport/eID chip— achieved Evaluation Assurance Level 4+ (EAL4+), demonstrating rigorous and independently verified security assurance.  

EAL5+ for Extended Access Control (EAC) with PACE  

A second configuration implementing Extended Access Control (EAC) and Password Authenticated Connection Establishment (PACE) —advanced mechanisms for protecting biometric information and authenticating inspection systems— achieved EAL5+, one of the highest assurance levels typically reached by secure, smart card-based technologies.  

These assurance levels demonstrate resistance to advanced attack scenarios and ensure strong protection of sensitive personal and biometric data. Such levels are widely required in international procurement processes for national identity and ePassport systems.  

International collaboration for a national identity project  

Throughout the evaluation process, MKSmart benefited from the combined expertise of Applus+ international teams, ensuring a smooth and well-guided certification journey. The serviceprovided included:  

• Assistance in preparing the Security Target (ST)  
• Guidance on the structure and completeness of evaluation evidence  
• Technical clarifications and follow-up activities during the assessment  

This international collaboration enables MKSmart ensure alignment with international evaluation practices and permits deployment in multiple regulatory environments across international markets.  

A significant milestone for Vietnam and beyond  

After several years of close cooperation, MKSmart celebrated the successful completion of both certifications at a ceremony in Hanoi in early 2026. These achievements validate the robustness of the ICAO application and position MKSmart as a trusted technology provider —not only within Vietnam’s national identity ecosystem, but also across international markets requiring high-assurance, standards-compliant identity solutions. The company also owns and operates smart card manufacturing facilities in Brazil and Ethiopia.  

Achieving Common Criteria EAL5+ certification is a key enabler for participation in global high-security identity programs, where independently verified security assurance is a mandatory requirement.  

About Applus+ Laboratories in Common Criteria  

We at Applus+ Laboratories are a global provider of Common Criteria evaluation services, with extensive experience in assessing high-security electronic identification (eID) solutions. Our involvement in major national identity projects —from work in Europe to our involvement in Vietnam's ePassport system — demonstrates our strong capability to ensure governments and technology providers deliver secure, trusted identification technologies.